[<prev] [day] [month] [year] [list]
Message-Id: <8F78BD12-E0FA-475E-A43E-ADAEB0B238B2@stig.io>
Date: Tue, 26 May 2026 02:28:42 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
oss-security@...ts.openwall.com
Subject: CVE-2026-9538: Archive::Tar versions before 3.10 for Perl allow
memory exhaustion via attacker controlled entry size field in tar header
========================================================================
CVE-2026-9538 CPAN Security Group
========================================================================
CVE ID: CVE-2026-9538
Distribution: Archive-Tar
Versions: before 3.10
MetaCPAN: https://metacpan.org/dist/Archive-Tar
VCS Repo: https://github.com/jib/archive-tar-new
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via
attacker controlled entry size field in tar header
Description
-----------
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via
attacker controlled entry size field in tar header.
_read_tar() reads each entry's payload with $handle->read($$data,
$block), where $block is derived from the entry's 12-byte size field in
the tar header with no upper bound on that value.
A crafted header declaring a multi-gigabyte size causes Perl to
allocate a scalar of that size.
Problem types
-------------
- CWE-789 Memory Allocation with Excessive Size Value
Solutions
---------
Upgrade to Archive::Tar 3.10 or later.
References
----------
https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch
https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes
Timeline
--------
- 2026-05-25: Issue reported.
- 2026-05-25: Version 3.10 released.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
